A maldet binary, combined with the ClamAV package, offers a powerful anti-malware server protection solution. It offers a serious level of malware protection in your server or containers cluster deployment.
In this article I give an overview and comparison of using a Drupal ClamAV module, that scans uploaded files, with a server-level malware scanning using Linux Malware Detect and ClamAV
Continue reading
Linux Malware Detect (https://github.com/rfxn/linux-malware-detect) is a great tool allowing to scan and clean Linux servers from malware. Whether you run Drupal, WordPress or Joomla, it runs in the background and monitors all traffic by system users, blocking malicious patterns. It is incredibly useful if your website is spamming. In a more recent post, Drupal ClamAV module vs maldet to eliminate malware in uploaded files, I outlined using Drupal ClamAV module with ClamAV to scan uploaded files for malware and virus. In addition to the normal user monitoring, it could be plugged into mod_security and provide great WAF (Web Application Firewall) protection. Whenever a file is getting uploaded to your server, maldet scans it for known malware and blocks all attempts to upload files that contain malware. Whether an infected file is uploaded via a known vulnerability in your application, maldet ensures such file is not stored in the filesystem. If your server has ClamAV installed, maldet automatically detects it’s availability and uses ClamAV engine to scan files and monitor user traffic in addition to its own. In my experience working with clean or compromised servers, adding maldet helps to stop the compromise immediately and buys you some time to clean […]
Continue reading
These days everyone is trying to pay attention to website security. Great effort. But as you hopefully know, the real security is the security at every level. Let’s review the very generic and common security feature, such as the username and password pair to secure login forms in millions of web applications. In the perfect scenario you would create a very unique and hard to guess username along with strong password (if your username is admin, bad luck!). In this case, whenever someone will be attempting a dictionary attack against your website, not only passwords needs to be discovered but usernames too. This makes the username/password security alone the strongest. In such scenario leaked username makes it only 50% success of a website breach (with password to be the remaining 50%) and gives your login form maximum protection possible. What is Username Enumeration Vulnerability Username enumeration is a type of vulnerability in web applications, where it is possible to find exact usernames or to confirm that a guessed (or leaked) username exists in the system based on system response. For example the password reset form may return different response based on the fact that the username exists in the system versus the opposite. […]
Continue reading